0

I have a website that uses Nginx web server, It's work on both HTTP and HTTPS mode, but I'm wondering that HTTPS not working for some users while working for many users at the same time! Also, all users can load the site in HTTP mode without a problem, the problem is just in SSL handshake.

Note: I gave the following command to my users and they gave me their outputs:

$ openssl s_client -connect example.com:443 -tlsextdebug

Success output for many users:

$ openssl s_client -connect example.com:443 -tlsextdebug
CONNECTED(00000003)
TLS server extension "renegotiation info" (id=65281), len=1
0001 - <SPACES/NULS>
    TLS server extension "EC point formats" (id=11), len=4
0000 - 03 00 01 02                                       ....
TLS server extension "session ticket" (id=35), len=0
TLS server extension "extended master secret" (id=23), len=0
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
verify return:1
depth=0 OU = Domain Control Validated, OU = PositiveSSL, CN = example.com
verify return:1
---
Certificate chain
..........

Failed output for other users:

$ openssl s_client -connect example.com:443 -tlsextdebug
CONNECTED(00000003)
TLS server extension "renegotiation info" (id=65281), len=1
0001 - <SPACES/NULS>
TLS server extension "EC point formats" (id=11), len=4
0000 - 03 00 01 02                                       ....
TLS server extension "session ticket" (id=35), len=0
TLS server extension "extended master secret" (id=23), len=0
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---

.......

Have you any idea that why this happens and how to resolve it?

  • Check your web server's error log. – Michael Hampton May 24 at 16:19
  • @MichaelHampton I did check it and nothing found about this issue there. – Mojbala May 24 at 19:45
  • For those clients where it fails - are they behind a firewall? – Sergey Nudnov May 25 at 3:54
  • @SergeyNudnov Actually, I guess their ISP bans SSL traffic on some IP ranges. I want to change server IP address and I hope it will be resolved. – Mojbala May 25 at 20:09
  • 1
    ISP bans SSL traffic?!! What country are they in? – Sergey Nudnov May 25 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.